From: "Jarkko Sakkinen" <jarkko@kernel.org>
To: "Mimi Zohar" <zohar@linux.ibm.com>,
"Roberto Sassu" <roberto.sassu@huaweicloud.com>,
<linux-integrity@vger.kernel.org>
Cc: <James.Bottomley@HansenPartnership.com>,
<roberto.sassu@huawei.com>, <mapengyu@gmail.com>,
"David Howells" <dhowells@redhat.com>,
"Paul Moore" <paul@paul-moore.com>,
"James Morris" <jmorris@namei.org>,
"Serge E. Hallyn" <serge@hallyn.com>,
"Peter Huewe" <peterhuewe@gmx.de>,
"Jason Gunthorpe" <jgg@ziepe.ca>, <keyrings@vger.kernel.org>,
<linux-security-module@vger.kernel.org>,
<linux-kernel@vger.kernel.org>
Subject: Re: [PATCH v5 0/5] Lazy flush for the auth session
Date: Wed, 16 Oct 2024 01:14:22 +0300 [thread overview]
Message-ID: <D4WQ58T5O21X.CGFKGFKV630K@kernel.org> (raw)
In-Reply-To: <036746bc4e37ff10a18b5fdffd6fdee561dd5bfe.camel@linux.ibm.com>
On Tue Oct 15, 2024 at 11:08 PM EEST, Mimi Zohar wrote:
> > > > since the feature itself is useful objectively, and make sure
> > > > that those fixes bring the wanted results.
>
> The right thing would have been to listen to my concerns when this was initially
> being discussed. The right thing wasn't enabling TCG_TPM2_HMAC by default.
This is debatable as for laptops and desktops having hard drive
encryption do benefit with this. If systemd hadn't added
systemd-cryptenroll I would agree with this. I learned about this
feature two years after its inception in that project, so we needed to
address this as a priority (I did not and will not follow systemd
development proactively, as don't have time for that).
I feel more safe using my laptop with the feature in place at least.
Besides, it is complicated feature enough that it would have been
impossible ever "zero glitch" land it. I don't think there is any
rigid "data centers first" rule really, except maybe for those
businesses that run data centers (and I'm not one of those
businesses).
BR, Jarkko
prev parent reply other threads:[~2024-10-15 22:14 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-09-21 12:08 [PATCH v5 0/5] Lazy flush for the auth session Jarkko Sakkinen
2024-09-21 12:08 ` [PATCH v5 1/5] tpm: Return on tpm2_create_null_primary() failure Jarkko Sakkinen
2024-10-03 14:57 ` Stefan Berger
2024-10-07 23:47 ` Jarkko Sakkinen
2024-09-21 12:08 ` [PATCH v5 2/5] tpm: Implement tpm2_load_null() rollback Jarkko Sakkinen
2024-10-03 15:27 ` Stefan Berger
2024-09-21 12:08 ` [PATCH v5 3/5] tpm: flush the null key only when /dev/tpm0 is accessed Jarkko Sakkinen
2024-09-21 12:08 ` [PATCH v5 4/5] tpm: Allocate chip->auth in tpm2_start_auth_session() Jarkko Sakkinen
2024-09-24 13:33 ` James Bottomley
2024-09-24 16:13 ` Jarkko Sakkinen
2024-09-24 18:13 ` Jarkko Sakkinen
2024-09-21 12:08 ` [PATCH v5 5/5] tpm: flush the auth session only when /dev/tpm0 is open Jarkko Sakkinen
2024-09-24 13:43 ` James Bottomley
2024-09-24 16:13 ` Jarkko Sakkinen
2024-09-24 18:07 ` Jarkko Sakkinen
2024-09-24 18:40 ` James Bottomley
2024-09-24 21:35 ` Jarkko Sakkinen
2024-09-24 21:51 ` James Bottomley
2024-09-25 7:42 ` Jarkko Sakkinen
2024-09-25 7:46 ` Jarkko Sakkinen
2024-09-25 7:53 ` Jarkko Sakkinen
2024-09-21 12:36 ` [PATCH v5 0/5] Lazy flush for the auth session Paul Menzel
2024-09-21 13:13 ` Jarkko Sakkinen
2024-09-21 14:38 ` Jarkko Sakkinen
2024-09-22 17:51 ` Jarkko Sakkinen
2024-09-24 13:48 ` James Bottomley
2024-09-24 16:29 ` Jarkko Sakkinen
2024-09-24 16:33 ` James Bottomley
2024-09-24 16:36 ` Jarkko Sakkinen
2024-09-24 17:26 ` Jarkko Sakkinen
2024-09-24 17:28 ` Jarkko Sakkinen
2024-09-24 18:01 ` Jarkko Sakkinen
2024-10-01 18:10 ` Mimi Zohar
2024-10-07 23:45 ` Jarkko Sakkinen
2024-10-03 15:14 ` Stefan Berger
2024-10-07 23:49 ` Jarkko Sakkinen
2024-10-11 14:06 ` Jarkko Sakkinen
2024-10-11 16:10 ` Roberto Sassu
2024-10-11 16:25 ` Jarkko Sakkinen
2024-10-12 10:56 ` Jarkko Sakkinen
2024-10-14 11:45 ` Mimi Zohar
2024-10-14 12:34 ` Jarkko Sakkinen
2024-10-15 20:08 ` Mimi Zohar
2024-10-15 22:14 ` Jarkko Sakkinen [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=D4WQ58T5O21X.CGFKGFKV630K@kernel.org \
--to=jarkko@kernel.org \
--cc=James.Bottomley@HansenPartnership.com \
--cc=dhowells@redhat.com \
--cc=jgg@ziepe.ca \
--cc=jmorris@namei.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mapengyu@gmail.com \
--cc=paul@paul-moore.com \
--cc=peterhuewe@gmx.de \
--cc=roberto.sassu@huawei.com \
--cc=roberto.sassu@huaweicloud.com \
--cc=serge@hallyn.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).